Fleet document retention UK: what DVSA and ICO require

Keep complete safety inspection and maintenance records for at least 15 months, run your electronic system so it is tamper-proof and can produce hard copies on request, and document why you retain every other category of fleet data. Those three rules govern fleet document retention UK wide, and they come from two separate authorities that do not always speak the same language.

The 15-month figure is a DVSA requirement covering roadworthiness. The second pillar, the ICO’s storage limitation principle, sets no fixed timeframe at all. It simply demands that you justify how long you keep personal data and review that decision periodically.

Do this by Friday:

  • Write down your retention schedule, even a basic one, with a period and a reason for each document type.
  • Confirm your 15-month maintenance files are actually retrievable, not just theoretically stored somewhere.
  • Check your audit trail and backups work by pulling a random vehicle file and timing how long it takes.

Pro Tip: If you cannot retrieve a vehicle’s full maintenance history in under five minutes, an examiner will notice the same delay during a maintenance investigation.

Key Takeaways

Fleet document retention UK compliance rests on two non-negotiables: 15-month DVSA maintenance records that are tamper-proof and retrievable, and an ICO-compliant justification for every other retention period you set.

Point Details
Meet the 15-month rule Keep safety inspection and maintenance records retrievable for at least 15 months, per DVSA guidance.
Justify every other period UK GDPR sets no fixed timeframe, so document the reason and review date for each data category.
Build evidential digital systems Ensure tamper-proofing, audit trails, date stamping, and hard-copy export before an audit, not during one.
Assign clear ownership Name a policy owner and deputy so review cycles and exception sign-off do not lapse.
Use a structured platform Velocerta ties retention tagging, audit trails, and export directly to each vehicle’s evidence file.

Table of Contents

Fleet documentation requirements UK inspectors actually check

DVSA examiners do not ask for everything. They ask for specific documents, in a specific state of completeness, and they expect to see them fast. Building your retention policy around what gets checked, rather than what feels comprehensive, saves time later.

The core inventory:

  • Safety inspection reports and maintenance and repair records, retained for a minimum of 15 months, including for vehicles no longer on your operator licence.
  • Drivers’ defect reports, showing faults were reported and rectified, kept alongside the vehicle’s maintenance file.
  • MOT certificates, current and historic, matched to the vehicle’s registration.
  • Tax and insurance evidence, refreshed as policies renew.
  • Tachograph data and driver licensing records, which carry their own retention logic tied to working-time and driving-hours enforcement rather than roadworthiness.

Some categories need different handling. Raw tachograph data is voluminous and time-stamped; many operators retain summarised analytics longer than the raw feed once the operational purpose has been served. CCTV and in-vehicle surveillance footage falls under ICO governance, which means retention, transparency to drivers, and subject-access handling all need documenting separately from your maintenance schedule. Payroll and HR records, and anything tied to a vehicle disposal or ownership change, sit outside the 15-month rule entirely and need their own justification.

The legal framework behind fleet document retention UK rules

Two authorities drive UK fleet documentation requirements, and they operate on different logic entirely. DVSA guidance is prescriptive: keep safety inspection and maintenance records for at least 15 months, and if maintenance is outsourced, keep the maintenance contract and the contractor’s competence evidence in the vehicle file too. That obligation sits underneath your operator licence, not alongside it.

Data protection law works differently.

UK GDPR sets no universal retention timeframe. Organisations must justify the retention period for each category of personal data they hold and document a review cycle for that decision.

That is the storage limitation principle in practice, and it means “we’ve always kept it” is not a defensible policy under the Data Protection Act 2018.

The overlap matters for telematics and CCTV specifically:

  • Transport enforcement asks: is the vehicle file complete and retrievable for 15 months?
  • Data protection asks: is this specific personal data category still needed, and have you reviewed that?

A record can satisfy DVSA and still breach data protection principles if nobody has reviewed why it is still there.

Digital record-keeping requirements for tamper-proof fleet files

An electronic system that merely stores files is not the same as one that produces evidence. DVSA guidance is specific about what a digital record-keeping setup needs to demonstrate, and it goes further than “we have a database”.

Evidential features your system must provide:

  • Tamper-proof storage that prevents silent edits to inspection or repair records.
  • An end-to-end audit trail showing who created, amended, or approved each entry.
  • Date and time stamping on every record.
  • An immutable log of sign-off and repair history per vehicle.

Operationally, you also need the ability to produce hard copies on request, scheduled backups with a disaster recovery plan, delegated access so a colleague’s absence never blocks a file retrieval, and clean organisation by vehicle rather than by document batch. On the data protection side, minimise what personal data you actually capture, define a lawful basis for telematics and CCTV before switching it on, set retention rules per data category rather than one blanket period, and keep DPIAs and processor contracts on file where third parties handle the data.

  1. Pick a random vehicle.
  2. Time how long it takes to produce its full 15-month file, including sign-offs.
  3. If it takes longer than a DVSA examiner would tolerate, fix the retrieval path, not just the storage.

Pro Tip: Run this drill quarterly. Systems that pass on day one often fail after six months of staff turnover and access changes nobody documented.

Building a retention schedule for fleet documents

A retention schedule is not a policy document gathering dust. It is a working table your team checks before deleting anything.

Document type Retention period Legal/regulatory justification Review frequency Disposal action
Safety inspection reports Minimum 15 months DVSA roadworthiness guidance Annual Secure digital wipe or shred
Maintenance and repair records Minimum 15 months DVSA operator licence conditions Annual Secure digital wipe or shred
Raw tachograph/GPS data Set by operational need, reviewed regularly ICO storage limitation principle Six-monthly Secure deletion
Aggregated telematics summaries Longer than raw data, where justified for safety analytics Documented business purpose Annual Archive then delete
CCTV/in-vehicle footage Short, purpose-limited ICO vehicle surveillance guidance Quarterly Automated overwrite

The aggregated telematics row is worth explaining: you can justify keeping trend data (average braking events per driver, say) longer than the raw GPS pings it came from, provided you can show the summary serves an ongoing safety purpose and the raw feed does not. Document that reasoning once, and reference it every time someone asks why two similar-looking data types have different lifespans. Exceptions to the schedule should need sign-off from whoever owns the policy, not a quiet decision by whoever happens to be clearing storage that week.

Preparing for a DVSA audit day

DVSA examiners work from a sample, not a full audit of every vehicle you run. MIVR guidance sets minimum file-sample sizes that scale with fleet size, and a small fleet can still face scrutiny of every vehicle it operates.

  1. Confirm safety inspection reports and maintenance history are retrievable per vehicle, not just per document type.
  2. Have MOT, tax, and insurance evidence ready alongside rectification proof for any reported defects.
  3. Keep a backup copy accessible separately from your primary system, in case of an outage on the day.
  4. If a file is incomplete, flag it before the examiner does, and document the gap with a remediation date.

A single missing file in a small sample carries more weight proportionally than the same gap would in a fleet of 200 vehicles, which is exactly why completeness matters more than volume.

Who owns fleet document retention and how it gets monitored

Retention policy needs a named owner, usually your compliance officer, backed by a system administrator who manages access and at least one designated deputy for continuity. Without that, review cycles quietly stop happening the moment someone changes role.

  • Policy owner: approves retention periods and signs off exceptions.
  • System administrator: manages backups, access controls, and technical audit logs.
  • Designated deputy: covers retrieval and sign-off during absence.
  • External maintenance providers: supply competence evidence and contracts for the vehicle file.

Run the review every six to twelve months, log every exception, and treat a missed review date as a compliance gap in itself.

Secure disposal and archiving when vehicles change ownership

Disposal needs the same rigour as storage. Digital records should be securely wiped or cryptographically deleted, paper files shredded, and every disposal logged to prove chain of custody.

When a vehicle changes ownership, the original operator stays responsible for preserving prior records for the required retention period. Transfer copies securely rather than assuming the new owner inherits your obligation.

Field Example entry
Document type Safety inspection file, Vehicle XX00 XXX
Disposal date Logged at time of action
Authorising person Policy owner or deputy
Method Secure digital deletion / certified shredding

How Velocerta supports fleet document retention UK requirements

Velocerta structures evidence per vehicle rather than per document batch, which matches how DVSA examiners actually sample files. Configurable retention rules apply the right period automatically, an immutable audit trail records every sign-off, and exports produce hard copies on demand, whether for DVSA or an internal review.

A typical workflow: a driver logs a walkaround check, a repair invoice attaches to that vehicle’s file, the system tags the record with its retention period automatically, a human reviewer confirms the entry, and the complete file exports in one action when an examiner asks for it. That structure supports the evidence chain DVSA guidance expects, without a compliance officer having to reconstruct it manually from separate spreadsheets each time.

Where fleet managers get retention wrong

Two mistakes recur constantly. Managers trust a dashboard summary instead of the underlying evidence chain, then discover the source file is missing when an examiner asks for it. They also skip documenting why a retention period was chosen, so a review six months later has nothing to check against.

Fix both by treating the dashboard as a pointer to evidence, never the evidence itself, and by writing the justification down the first time, not after someone asks.

Get your retention schedule audit-ready with Velocerta

Velocerta gives fleet operators a way to stop rebuilding vehicle files from scratch every time an examiner or auditor asks for one. Structured evidence per vehicle, configurable retention tagging, and human-reviewed alerts mean your 15-month files stay complete and retrievable without a spreadsheet chase the night before an inspection.

Every case moves through role-based access and an immutable audit trail, so disposal, review, and sign-off responsibilities stay traceable to a named person rather than a shared login. For taxi and private-hire operators managing operator-licence obligations alongside driver records, the taxi and private-hire compliance solution maps directly onto the record types DVSA examiners sample. If you run a broader commercial fleet, the fleet operator compliance page covers the same retention and audit workflow at scale. Book a demo to see how your current retention schedule would look inside the platform.

Frequently asked questions

How long must UK fleets keep maintenance records? DVSA guidance requires a minimum of 15 months for safety inspection reports and maintenance history, including records for vehicles no longer on your operator licence.

Does UK GDPR set a fixed retention period for fleet data? No. The ICO’s storage limitation principle requires organisations to justify each retention period rather than follow a universal timeframe.

Can electronic records replace paper files for DVSA audits? Yes, provided the system is tamper-proof, time-stamped, maintains an audit trail, and can produce hard copies on demand.

What happens to records when a vehicle is sold? The original operator remains responsible for preserving records for the required retention period and must transfer copies securely to the new owner rather than assuming the obligation transfers automatically.

Does Brexit affect UK fleet document retention rules? UK GDPR and the Data Protection Act 2018 continue to apply as the retained domestic framework, and DVSA roadworthiness requirements were already UK-specific, so the core retention obligations described here remain unchanged.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Sources

Recommended